I'm worried these devices are going to be utterly unrecoverable if anything goes wrong.
Secure boot being enabled means mtk_uartboot (which is being used to recover the RT3200 from the Kiss-of-Death) is not a viable path to recovery.
This means any flashing of BL2 or FIP carries a risk of delivering a fancy paperweight. (Because the only ability to recover anything is AFAICT via serial and the bl2+fip provided uboot - so if those aren't working...)
[There's a slight chance that a FIP failure is recoverable from a functioning BL2 via some hardcoded-in-BL2 tftp logic, trying to download a FIP via some hardcoded ipaddr/serverip/filename, but who knows - certainly not worth the risk of testing this...]
Similarly (to the RT3200) don't lose the factory partition if you want working wifi - that likely stores some important wifi chip calibration information (& the macs).
Furthermore, the lack of a usb connector means there's no convenient spot to plug in something like RP2040-One, Pico-Like MCU Board Based on Raspberry Pi RP2040, 4MB Flash MCU Board, Dual-Core Arm Cortex M0+ Processor up to 133 MHz, Onboard USB Type-A Plug,Plug and Play to interact with the serial port...
I guess it all depends on what firmware version these things ship with.
(and as a reminder don't let them boot into stock firmware while connected to the internet: they'll most likely upgrade the bl2/fip and lock things down tighter)